AI Model Exploitation in Account Takeovers: The Claude Opus 5 and OpenAI Breach Chain

Three researchers at the security firm Hacktron used Anthropic's Claude Opus 5 to execute a multi-step account takeover against OpenAI staff members. The attack began by exploiting a bug in OpenAI's public help forum software, which allowed the researchers to inject code or manipulate forum data. From that initial foothold, they moved laterally to a weakness in OpenAI's login authentication system, using Claude Opus 5 to automate the exploration of both flaws and craft the connecting payload. The result was unauthorized access to employee ChatGPT and Codex accounts, followed by penetration into an internal code repository.

This was not a zero-day against OpenAI itself, but rather a deliberate proof-of-concept in which researchers intentionally chained known or newly discovered flaws under controlled conditions and disclosed them to OpenAI. The use of an LLM to orchestrate the attack is the notable detail: Claude Opus 5 was used not just to brainstorm the attack, but to automate reconnaissance, payload generation and execution steps.

A single vulnerability is usually contained: a developer patches it, a security team tests the patch, the risk is mitigated. But when two or more flaws exist in different layers of a system, an attacker who understands the full architecture can use the first flaw as a springboard to exploit the second. In this case, the help forum bug gave researchers a way to inject or alter data that could be consumed by the login system, and the login system did not sufficiently validate or isolate that data.

Vulnerability chains are not new, but what has changed is the speed and scale at which they can be discovered and exploited. Manual security researchers would need to spend weeks mapping how flaws interact. Claude Opus 5, instructed with enough context about OpenAI's architecture (which researchers could infer from public documentation, error messages and trial), could generate multiple hypothetical attack chains in hours. The model could also iterate on failed payloads based on feedback.

Claude Opus 5 is Anthropic's flagship large language model, designed for complex reasoning and code generation. In this research, it was used to automate parts of the attack chain that would normally require manual scripting or reconnaissance. For example, the model could generate candidate payloads for the forum vulnerability, simulate how OpenAI's login system might parse malicious input, and refine the attack based on expected or observed behavior.

The model's capabilities created a force multiplier effect: rather than a skilled attacker manually testing dozens of payload variations, Claude could generate and reason about hundreds. This mirrors a broader concern in AI security: models trained to understand and generate code become powerful tools not just for builders, but for attackers who can prompt them with enough context. Crucially, the researchers likely used Claude in a straightforward way—asking it to help exploit known or suspected weaknesses—without needing to circumvent any safety guardrails, because the model was being used within Hacktron's own environment.

This incident sits at the intersection of three separate problems. First, AI models can compress attack research time: law enforcement and security researchers note that LLMs have reduced the time from vulnerability discovery to weaponized exploit from months to days in some cases (see: security vendor incident reports on malware generation). Second, companies still treat authentication and data isolation as separate domains: OpenAI's login system and its help forum were likely owned by different teams and tested in isolation, a common architectural oversight. Third, proof-of-concept attacks like this one often go unpatched for months after disclosure, creating a window where the same chain could be repeated by less scrupulous actors.

Why it matters: Organizations that rely on external APIs or multi-layer identity systems face compound risk when each layer is tested independently. The barrier to chaining those flaws has dropped dramatically.

For ordinary users, this research underscores the value of account security practices that assume account takeover is possible. Using separate, strong passwords for each service means that if one account is compromised, others remain protected. Enabling multi-factor authentication on accounts tied to sensitive services (like developer platforms or payment systems) significantly raises the cost of account takeovers, because an attacker would need to compromise not just the login credentials but also the secondary authentication device.

For organizations, the lesson is that penetration testing, code audits and threat modeling need to account for attack chains, not just isolated vulnerabilities. A security review that finds one bug in the forum and another in the login system, then resolves each independently, has not actually reduced the attack surface. Teams from different product areas need to collaborate during security assessments to understand how data flows between systems and where validation might be missing.

Hacktron's research was released as a responsible disclosure: the vulnerabilities were reported to OpenAI before publication, giving the company time to patch. This is the expected behavior from security researchers and is crucial to the trust model that keeps the internet functional. What makes this disclosure notable is that it names the tool used (Claude Opus 5) and demonstrates a tangible use case for LLM-assisted attack research.

Anthropics and other AI safety teams will likely use this incident to refine what they consider risky LLM outputs. Currently, most LLM providers block direct requests to write malware or exploits, but they do not typically block requests to reason about hypothetical vulnerabilities or generate code that could be used in security research. The boundary between legitimate research automation and reckless capability transfer remains blurry, and incidents like this one help clarify where that line should be drawn.

If you use OpenAI services for work or development, take three immediate steps. First, change your password for any account tied to ChatGPT or OpenAI APIs, especially if you have not done so in the past year. Second, check your account activity log for any sessions or API key usage you do not recognize, and revoke any keys that are not in active use. Third, enable two-factor authentication if your account type supports it. Organizations should audit which accounts have access to internal repositories or sensitive code, and ensure that authentication to those repositories does not rely solely on the same credentials used for public-facing services like ChatGPT.

Source: The Hacker News